DOYLE — corrected script + exact kitsubito probe block

Script defect fixed at source: native commands now run under temporary EAP=Continue and are judged by LASTEXITCODE, avoiding Windows PowerShell 5.1's redirected-stderr NativeCommandError. Static parse under powershell.exe: PARSE_OK. Corrected full script was sent in the preceding message. `pwsh` remains the safest elevated invocation:

pwsh -NoProfile -ExecutionPolicy Bypass -File C:\Users\decid\.omp\state\spt-endpoint\gaki-uac-repro.ps1 -Leg elevated -Adapter claude-spt:ccs -Subnet SPT_DEV

Kitsubito source endpoint discovered from its local roster: `omp-spt-accept-gnu-fresh` (node cfd9fc55, local live_agent). Exact differential block, run once with TARGET=gaki-normal-probe and once with TARGET=gaki-elev-probe:

```sh
set -eu
TARGET="${TARGET:?set TARGET}"
STAMP="$(date -u +%Y%m%dT%H%M%SZ)"
OUT="/tmp/${TARGET}-${STAMP}"
mkdir -p "$OUT"
spt --version >"$OUT/spt-version.txt" 2>&1
spt daemon status --json >"$OUT/daemon-status.json" 2>&1
spt api endpoint-info "$TARGET" --json >"$OUT/endpoint-info.json" 2>&1
spt endpoint list --json >"$OUT/endpoint-list.json" 2>&1
set +e
timeout -k 2s 8s script -qfec "spt rc --view $TARGET" "$OUT/rc.typescript"
printf '%s\n' "$?" >"$OUT/rc-exit.txt"
PROBE="GAKI_UAC_WAN_PROBE_${TARGET}_${STAMP}"
timeout -k 2s 15s sh -c "printf '%s\\n' '$PROBE' | spt send '$TARGET' --from omp-spt-accept-gnu-fresh" >"$OUT/send.txt" 2>&1
printf '%s\n' "$?" >"$OUT/send-exit.txt"
set -e
printf 'REMOTE_PROBE_DONE:%s:%s:%s\n' "$TARGET" "$PROBE" "$OUT"
```

I already ran the RC half against `gaki-normal-probe`. Result: PASS. Transcript contains `PUMP_IPC_READER: spawned`, `[viewing 80x24 ...]`, and live harness output; timeout then terminated the deliberately bounded read-only viewport. Capture: `/tmp/gaki-normal-rc-0424.typescript` on kitsubito.

My canonical-send attempt from `omp-spt-accept-gnu-fresh` did not return within a 20-second local SSH bound and produced no stdout/stderr. Treat that as a probe-harness observation, NOT yet a product verdict: I had an earlier non-killing `timeout` RC attempt that may have left a remote process, and the chosen sender reports local `ready:false, alive:true`. Your clean block uses `timeout -k`, records exit status, and should be run after checking/removing only my leftover `/tmp/gaki-normal-rc*.typescript` process group if present. If sender readiness is material, select another kitsubito-local ready perch and substitute its ID; preserve the chosen source in the report.

For each target, success criteria:
- RC: transcript reaches live harness output; bounded exit 124/137 is expected after successful attachment. Immediate `No live session` is failure.
- Send: `SENT:<target>` or `QUEUED:<target>` inside 15s, then visually/trace-confirm exact PROBE body at target.
- Compare endpoint-info node key, daemon captures, and Windows-leg facts before attributing any delta to elevation.